Subject: [ietf-dkim] DKIM Agenda Item Safer than SSP

From: Douglas Otis <[email-masked]>
Date: Wed, 5 Jul 2006 14:30:36 -0700

As indicated in the threat draft, SSP will not mitigate both a likely  
and high impact threat caused by a lack of email-address recognition  
due to internationalization.

One possible approach for handling this issue would be to utilize  
known correspondence lists (perhaps obtained from the address book or  
selected correspondents) in conjunction with message annotation.   
Message annotation of known and verified sources is a proactive  
recommendation of the APWG.  Additional protection can be achieved by  
leveraging a known list with advice from the signing domain.

See:
http://tools.ietf.org/wg/dkim/draft-otis-dkim-reliance-level-00.txt

Messages annotated based upon known signing domains conflicts with  
generalized SSP repudiation assertions that "all messages from a  
particular email-address domain are signed."  This conflict between  
annotation and SSP repudiation induces a significant risk when  
sources within the signing domain are not equally vetted.   
Partitioning message sources within known signing domains permits  
safe retention of message repudiation, while not inadvertently  
causing recipients to trust sources beyond what the signing domain  
considers prudent.  Offering accurate reliance advice helps the  
signing domain retain favorable annotations for their well-vetted  
message sources.

One possible alternative for the reliance level could be conventions  
for selector labels, but this approach will cause a greater impact  
upon the DNS message size and cache requirements.  The example  
reliance level draft offers three separate domain partitions.  Each  
source partition could easily be separately assigned an accrual  
status within a single query.  A diversity of selector label names  
for achieving the segregation of sources increases the amount of  
information that must be distributed out-of-band.

Rather than focusing upon SSP, another concern is related to DoS  
attacks.  These attacks might be mitigated by using name-path  
registration.  The name-path as defined can indicate whether the path  
is open or closed ended to allow repudiation of unsigned messages,  
while also providing a safe method to defend against DoS.

See:
http://www.ietf.org/internet-drafts/draft-otis-smtp-name-path-00.txt

-Doug

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 5 Jul 2006 18:12:38 -0400

At 2:30 PM -0700 7/5/06, Douglas Otis wrote:
>As indicated in the threat draft, SSP will not mitigate both a 
>likely and high impact threat caused by a lack of email-address 
>recognition due to internationalization.

It is premature to try to guess how internationalized email addresses 
will look or be handled. We should not cover this in DKIM until the 
work in the EAI WG is finished.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave Crocker <[email-masked]>
Date: Wed, 05 Jul 2006 17:26:48 -0700

> It is premature to try to guess how internationalized email addresses will
> look or be handled. We should not cover this in DKIM until the work in the
> EAI WG is finished.

+1

+1

+1...

Creating critical dependencies on a specific outcome of a difficult and
controversial bit of IETF work -- and especially one with a long history -- is a
really excellent way to fail.

d/

-- 

  Dave Crocker
  Brandenburg InternetWorking
  bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Wed, 5 Jul 2006 18:20:16 -0700

> really excellent way to fail.

This seems to be a comment against SSP.  The alternative being  
suggested makes no assumptions about internationalization or a  
recipient's ability to recognize an email-address. Whereas SSP  
protection through categorization of non-signed messages depends  
primarily upon the increasingly questionable recognitions which are  
already impacted by domain name internationalization that is not  
affected by the outcome of the EAI WG.  The threat draft has already  
concluded this threat represents a high impact high likelihood.  If  
nothing else there was already some consensus regarding this  
concern.  There are no dependencies related to the suggested  
solutions however.

-Doug

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 6 Jul 2006 07:21:36 -0400

At 6:20 PM -0700 7/5/06, Douglas Otis wrote:
>This seems to be a comment against SSP.

Wrong. it is a comment against trying to predict the future and 
gating our publication on those guesses. We can (should!) remain 
silent on future changes to email, and then deal with them when they 
happen. This is how IETF protocol development works.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave Crocker <[email-masked]>
Date: Thu, 06 Jul 2006 04:30:43 -0700

Paul Hoffman wrote:
> Wrong. it is a comment against trying to predict the future and gating
> our publication on those guesses. We can (should!) remain silent on
> future changes to email, and then deal with them when they happen. This
> is how IETF protocol development works.

Correct on all 3 counts.

and i suggest that we can now end this thread.

d/

-- 

  Dave Crocker

---

From: Douglas Otis <[email-masked]>
Date: Thu, 6 Jul 2006 08:57:46 -0700

On Jul 6, 2006, at 4:30 AM, Dave Crocker wrote:

>> gating

Anticipating outcomes subsequent to deployment of a new protocol  
remains germane.  That was the purpose of the threat review, was it not?

Efforts related to this anticipation should include newer protocols,  
especially with increasing reliance upon features of recent  
developments.  Indicating internationalization features _may_  
encompass the local-part, in addition to the domain, only emphasizes  
the generic internationalization concerns _already_ raised in the  
threat review.  Reliance upon email-address recognition ignores these  
concerns, and is the criticism directed toward SSP.  Reliance upon  
email-address recognition remains dependent upon either future  
abandonment of internationalization, development of character  
repertoire reporting, or massive acquisitions of look-alike domains.   
As DKIM is transparent, annotation needed to convey DKIM  
verifications as recommended by the APWG can combine with known  
signing domains to also overcome the internationalization threat.   
This embraces internationalization as it exists today and tomorrow,  
but protection is further improved with a DKIM convention that  
partitions sources within the signing domain.

-Doug